6.5Medium

CVE-2025-1704

Google ChromeOS Published: 2025-04-17 02:06 (1 year ago)

Description

ComponentInstaller Modification in ComponentInstaller in Google ChromeOS 15823.23.0 on Chromebooks allows enrolled users with local access to unenroll devices and intercept device management requests via loading components from the unencrypted stateful partition.

Weakness (CWE): CWE-416

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
google	chrome os	15823.23.0
Google	ChromeOS	15823.23.0 – < 15823.23.0

References and patches

https://issuetracker.google.com/issues/359915523 ExploitIssue TrackingMailing List
https://issues.chromium.org/issues/b/359915523 Broken Link

CPE matches (NVD) (1)

cpe:2.3:o:google:chrome_os:15823.23.0:*:*:*:*:*:*:*

CVSS score

6.5Medium

Source: CISA-ADP · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

All scores (2)

CISA-ADP	CVSS 3.1	6.5Medium
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	6.5Medium

EPSS (chance of exploitation in 30 days)

0.21%

higher than 11% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2025-02-25
Published2025-04-17 02:06
Reached IP-DB2026-10-24 23:59
Last updated2026-06-17 11:39

Assigned by (CNA): ChromeOS
NVD status: Analyzed

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time